CVE-2026-100190
Deferred Deferred - Pending Action

Stored XSS in AIL Framework Crawler Splash Domain Page

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CIRCL

Description
The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts within the HTML template. This included an onclick attribute that embedded raw screenshot and URL values into a JavaScript function call, and an inline script block that assigned a screenshot value to a JavaScript variable without escaping. An attacker with a user-role API client could craft a malicious crawler capture import containing JavaScript payloads in these fields. When any user (including privileged users) subsequently viewed the affected domain page, the injected script would execute in the victim's browser context, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the victim. The vulnerability is stored in the application's data layer and triggered upon page rendering, requiring no further interaction beyond loading the domain view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-100190
EUVD
EUVD-2026-87096

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the AIL Framework crawler's splash domain page. It allows an attacker with user-role access to inject malicious JavaScript via imported crawler captures. The injected script executes when other users view the affected domain page, potentially enabling session hijacking or data theft.

Detection Guidance

To detect this vulnerability, inspect the AIL Framework crawler splash domain page (showDomain.html) for stored XSS payloads in item IDs, URLs, or screenshot file paths. Check for JavaScript execution in onclick attributes or inline script blocks that embed unescaped user-supplied data. Review imported crawler captures for malicious payloads in these fields.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal session cookies, perform actions on your behalf, or exfiltrate sensitive data. It requires an attacker to first gain user-role access to import malicious crawler captures, but once triggered, it affects all users viewing the compromised domain page.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using AIL Framework may face compliance violations if exploited.

Mitigation Strategies

Immediately update the AIL Framework to a patched version that properly escapes user-supplied data in the showDomain.html template. Sanitize all imported crawler captures by validating and escaping item IDs, URLs, and screenshot file paths before rendering. Restrict user-role API clients to trusted sources to prevent malicious imports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart